Add EVP_CIPHER_CTX_legacy_clear()

OpenSSL 1.1 made EVP_CIPHER_CTX_init() an alias of EVP_CIPHER_CTX_reset().
In particular, it changed signature and it would no longer leak internal
state if used on an already used ctx. On the other hand, it can't be used
for ctx on the stack.

libcrypto still has a few ctx on the stack which will be converted to heap
allocated contexts at some point. Until this is completed, we will use
EVP_CIPHER_CTX_legacy_clear() internally, so that the public API can be
changed to match OpenSSL 1.1.

ok jsing

1 files changed, 7 insertions, 1 deletions

diff --git a/src/lib/libcrypto/evp/evp_cipher.c b/src/lib/libcrypto/evp/evp_cipher.c
index abdc33eace..94eb42a807 100644
--- a/src/lib/libcrypto/evp/evp_cipher.c
+++ b/src/lib/libcrypto/evp/evp_cipher.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: evp_cipher.c,v 1.17 2024/01/30 17:41:01 tb Exp $ */
+/* $OpenBSD: evp_cipher.c,v 1.18 2024/02/18 15:41:50 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -618,6 +618,12 @@ EVP_CIPHER_CTX_init(EVP_CIPHER_CTX *ctx)
         memset(ctx, 0, sizeof(EVP_CIPHER_CTX));
 }
 
+void
+EVP_CIPHER_CTX_legacy_clear(EVP_CIPHER_CTX *ctx)
+{
+        memset(ctx, 0, sizeof(*ctx));
+}
+
 int
 EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *ctx)
 {